Highlights: WADA, Clinton, Macron

Secondary Infektion sometimes focused on issues that were targeted simultaneously by other known Russian information operations, including that of both the Internet Research Agency and the various actors within Russian military intelligence who were responsible for hacking and leaking politically important documents.^[102]

This was not a question of Secondary Infektion amplifying or repeating posts made by other Russian operations; rather, it directed its efforts toward the same targets, albeit with a different approach, using its own unique combination of forged documents and fake accounts, even when genuine leaked documents might have been available.

For example, in November 2015 the World Anti-Doping Agency (WADA) published a report that accused Russia of systematic state-sponsored doping in the 2012 Olympic Games.^[103] In July 2016, a follow-up report accused Russia of the same practices at the 2014 Winter Olympics and recommended that Russia be banned from future competitions, including the 2016 Olympics in Rio de Janeiro.^[104] The accusations triggered a full-spectrum Kremlin information operation that included deploying hackers from Russian military intelligence to break into the servers of the International Olympic Committee (IOC) and a Rio 2016 account of WADA's Anti-Doping Administration and Management System, and the creation of the "Fancy Bears Hack Team" persona to leak the hacked materials to journalists.^[105] Accounts from the Internet Research Agency also joined on the #dopingleaks campaign, operating side by side, albeit without evident coordination, with accounts operated by the GRU.^[106]

Before the GRU hackers deployed against WADA and the IOC, Secondary Infektion forged a false leak that appeared intended to discredit the doping agency. In April 2016, the operation ran a story in English, German, and Russian that alleged that WADA had colluded with the giants of the pharmaceutical industry to ban the drug “meldonium,” also known as “Mildronate,” in order to undermine it as a competitor^[107]:

Unfortunately, bribery of top ranking officials in anti-doping organizations community appears nowadays to be a usual business. (...) As for unfair competition in pharmacology, here we undoubtedly face absolutely new level of corruption.

The article embedded a letter allegedly sent by the head of the Committee to Protect Journalists, Joel Simon, to WADA head Sir Craig Reedie, together with a memo attributed to WADA’s finance committee.^[108] The letter from Simon accused WADA of orchestrating a harassment campaign against journalists covering the scandal, but offered to cover up the affair in return for an end to the harassment, “for we see it as totally unacceptable and insecure to discredit the international institutions under the current political situation being so tense.” The memo from WADA accepted these surrender terms and discussed how to find out which journalists were involved, and how to keep them quiet. Both WADA and the CPJ confirmed to Graphika that the documents were fake.

Secondary Infektion image

The headers of the “memo” (left) and the “letter” (right) embedded in the false story.

WADA spokesman James Fitzgerald told Graphika, “a matter raised by a journalist body in relation to the pharmaceutical industry or a substance on the Prohibited List would not be one for the Finance & Administration Committee to consider. In addition, letters or memos sent to our various Standing Committee members do not look like this. And finally, the fact this document is so poorly written, with several grammatical errors, would be another clue.”

Typically for Secondary Infektion, the claims were not picked up beyond its own cluster of usual websites.^[109] This is a significant contrast with the GRU’s later leaking of apparently genuine documents, which achieved widespread coverage, not least because the GRU shopped the leaks directly to willing journalists^[110] or with some of the Russian IRA’s personas traction within the communities it sought to target (such as Jenna Abrams’ online musings on the “doping leaks”).

Similarly, in early 2017, a range of Russian information operations began attacking French presidential candidate Emmanuel Macron after he emerged as the surprise leader in the election. In the words of the director of the French Institute for Strategic Research (IRSEM, at the French Ministry of Defense), Jean-Baptiste Jeangene-Vilmer, “There was a coordinated attempt to undermine Macron’s candidacy, through a classic three-dimensional information operation: (1) a disinformation campaign consisting of rumors, fake news, and even forged documents; (2) a hack targeting the computers of his campaign staff; (3) a leak—15 GB of stolen data, including 21,075 emails, released on Friday, May 5, 2017—just two days before the second and final round of the presidential election.”^[111] As part of the disinformation (or “information manipulation”) campaign, Jeangene-Vilmer catalogued a series of false, misleading, or biased claims about Macron that were amplified by Kremlin outlets from late January 2017 onward.

Separately from these attacks, Secondary Infektion launched three separate stories that targeted Macron in March through May 2017. This was the only time in the operation’s six-year history that it focused on the French politician, suggesting that this newfound focus was driven by the electoral timeline.

The attack initially focused on immigration, especially by Muslims, a key theme highlighted by supporters of Macron’s rival Marine Le Pen. On March 16, the operation ran a story headlined, “Emmanuel Macron: the new hope of migrants in Europe?”^[112] This was posted in unidiomatic English the same day by single-use burner accounts on Medium, Quora,^[113] survivefrance.com,^[114] politicalforum.com, and politicsforum.co.uk^[115] and in German the following day on meine-news.de and geschichte-wissen.de.^[116]

The article claimed that Macron had written an attack on Merkel for not doing enough to take in migrants and asked “whether such a short-sighted statement by the ambitious candidate is going to make the immigrants assault French borders soon?” However, the "attack" it cited was written in clumsy, grammatically incorrect French and posted by a single-use burner account called “Gerard” two days earlier: it bears all the markings of posts crafted by Seondary Infektion. ^[117]

On April 20, the operation planted a story that Macron was prioritizing political support from migrants over French national security. This was posted in English on Reddit (which first exposed the post), defendingthetruth.com, politicsforum.org, and homment.com.^[118] It was based on a screenshot of an “official document” that showed that the number of Muslims acquiring French citizenship had soared; once more, the use of French was clumsy and grammatically incorrect. (The screenshot can no longer be viewed in the English-language versions but remains visible in the Russian-language editions.^[119])

Secondary Infektion image

Screenshot of the alleged “official document” attributed to the Ministry of the Interior, annotated by a French native speaker to highlight linguistic errors. As small examples, the entries “Alger” and “Tunis” are presumably meant to be the country names “Algerie” and “Tunisie”; in fact, they name two cities in those countries (and would therefore escape a spell-check).

On the eve of the final round of the election on May 6, 2017, just after Russian hackers dumped the “Macron leaks” online,^[120] the operation launched a pseudo-analytical piece arguing that Macron was “an embodied synthesis of industrial and banking PR-technologies and pan-European red-tape lobbyists.”^[121] Rather than focusing on migration and Islam, it focused on his background and alleged character as a “synthetic media homunculus that matches all criteria of a negative political selection.” The author concluded by posing as a French citizen who was outraged at Macron’s progress:

I am not a fan of Marine Le Pen. I’ve never desired to experience her election agenda in action. Yet I firmly believe that the choice is up to a nation and no one else. Even if the nation makes a fatal mistake. Anyone usurping this sacred right is a criminal liable to penalty. This is what should be told to the face of those who tries hard to make fools out of us imposing outside and strange choice on France.

None of these stories gained significant traction. It is noteworthy that Secondary Infektion did not mention or amplify the Macron leaks, either before the election or afterward. Its attacks on Macron also did not pick up on the themes amplified by other parts of the Russian influence apparatus.

A third example similarly highlights how Secondary Infektion paralleled other Russian operations, seemingly without coordination. In 2016, while the GRU and Russian IRA were both running large-scale campaigns to undermine the candidacy of Hillary Clinton and divide the American electorate, Secondary Infektion did the same. Repeatedly from November 2015 through November 2016, it posted attacks on Clinton. However, these posts barely mentioned the GRU’s hacks and leaks, and available archives of IRA posts^[122] show no mention of Secondary Infektion’s stories or personas.

The attacks started on November 26, 2015, with an article that combined outspoken anti-Clinton sentiment with clumsy, unidiomatic English.^[123] Unsurprisingly, it did not appear to gain traction:

"The most warmongering lady ever lived in the White House has been thirsting for returning back in a new role. In 2008, American voters made it clear that they don’t want Hildebeast as a U.S. President. But it looks like Mrs. Clinton doesn’t bothers [sic] with such nonsense as Will of the American People. The former First Lady has been showing such stubbornness pursuing this aim that it looks like horns would thrust threw her brow soon."

This was an early and relatively isolated salvo; unusually, it was not amplified by Secondary Infektion’s contemporary German and Russian personas. In 2016, however, the attacks became more frequent and systematic.

An article in May 2016 accused Clinton of being in the pay of the Saudi regime^[124]; a post in June accused her of being allowed to “steal most part of the [Democratic Party] delegates from Bernie Sanders.”^[125] One July article argued that Clinton was in China’s pocket,^[126] and another argued that the GRU’s leak of Democratic emails was actually a Clinton plot to silence Sanders supporters.^[127] An August article focused on claims that Clinton had serious health problems.^[128] Intriguingly, none of these was based on a forged document.

An article on October 31, 2016, appears to have been based on a fake, but the document in question was a petition, not a screenshot of a document.^[129] This article was particularly outspoken, calling the chance that Clinton would win “the most terrible mistake in the modern American history” and accusing her of “blatant impudence, barefaced lie, sordid treachery, scandalous revelations, corruption, and contract killings on top of that.” A translation was posted in Russian by single-use burner accounts to multiple forums used by Secondary Infektion.^[130]

The petition in question was created on thepetitionsite.com^[131] on or around October 27, 2016 (the petition was undated, but according to the page source, the last date for signatures was October 27, 2017, giving a likely one-year range). It was addressed to the US Supreme Court and attributed to a Libyan who “lost my family and many of my relatives and friends” in Libya’s conflicts. By May 2020, it only had 16 signatories, and the only references to it available online were on posts that can confidently be attributed to Secondary Infektion itself, suggesting that the petition was planted by the operation itself.

Secondary Infektion image

Spread of the story from the petitionsite.com (left) through Reddit, Medium and homment.com (center) to dosug.md, korrespondent.net, and amigos.lv (right).

< Prev Next >